How do you access local group/users in Server Manager - Security roles/users?

TerryGiles · ‎12-18-2012

I can't figure this out, but am hoping it can be done. In Server 10.0 I could grab a group from the local server and us it for security on a folder of services. Is this possible in 10.1? I've tried the following config settings which don't work -

Users from existing system (Windows Domain) & Roles from built-in store
when prompted for the windows credentials, I've tried entering <server>\local_user .\local_user and it allows returns an ldap related error. only if I give it a domain\domain_user will it work.

I found it very easy in 10.0 to set up local groups and add domain accounts to them for security. If I can only get users from Active Directory, how do I add everyone to a 'users' group, so our open access/base data services can be viewed by anyone on the domain?

Any and all suggestions welcome!

Thanks,

Terry

TerryGiles · ‎12-28-2012

Spoke with Esri tech support yesterday and in 10.1 you can no longer access local groups on the server. 😞
Not sure why functionality was taken out at 10.1 but it was. As far as I can tell, this produces an interesting situation -

I've configured security using Windows AD for the user store and the Built-In groups. Since the AD user store only shows Users and not Groups, the only way to ensure all users in our agency (100s of them) can see our base/reference layers is to add EACH USER to a 'User' role. Am I understanding that correctly??

To clarify, I'm used my Web Server for authentication, not the GIS Server, so setting the 'Public' or 'Allow access to all users who are logged' options in security settings are not available.

Thanks again, TG

MōnoSimeone · ‎02-07-2013

Hi -

If I'm understanding you correctly, this means that for a single-machine setup that I can't use the local groups or users (ie existing users from agsadmin or agsusers groups)? That I can't configure the security setting using Web Server Authentication???

I am having the issue where when I press the Test Connection button it doesn't do anything. When I try to finish the configuration for a Web Server Authentication with Web Tier it just hangs. I've uninstalled and re-installed.

Thoughts???

Thanks,
M.

JustinRodriguez · ‎02-07-2013

Hi -

If I'm understanding you correctly, this means that for a single-machine setup that I can't use the local groups or users (ie existing users from agsadmin or agsusers groups)? That I can't configure the security setting using Web Server Authentication???

I am having the issue where when I press the Test Connection button it doesn't do anything. When I try to finish the configuration for a Web Server Authentication with Web Tier it just hangs. I've uninstalled and re-installed.

Thoughts???

Thanks,
M.

Hello M.

So you cannot use the agsadmin or agsusers if they were local to the machine. AGS 10.1 only allows Domain users.

As far as the issue setting up your security in ArcGIS for Server, it seems like you might be a little confused on some of the settings. It is difficult for met to tell what type of configuration you are looking for based on your description. It seems like you might be trying to use Web Tier Authentication, which would require a Web Adaptor with a pre-shared key.
It also seems like you might not be using a domain account, or just not pointing to the domain properly, when you are configuring windows security.
My best suggestion would be to call tech support at (888)377-4575 so a technician can help you with this configuration. If you have some specific questions, please feel free to ask on the forum, but it might take a while to set up your security with using forum posts only.

I hope that helps a bit. Thanks-

MōnoSimeone · ‎02-08-2013

The issue is a bug. I spoke with Tech support and it's a known bug that will be fixed in the next release...when ever that is. The feature of accessing local groups & users was available in 10.0 but for some reason was skipped over in 10.1. The issue #: NIM083139.

Currently, there is no work-around and I will have to use the Built-In Store for now.

Thanks for your reply Justin. The Web Adapter was installed and I made the necessary changes in IIS to enable Windows Authentication. It's good to know I wasn't crazy.